EN FR
Features How it works Pricing Contact Login
🕒 Last updated: October 14, 2026

AI rules: filter your email with plain-language conditions

Learn what the "AI rules" module of the Clean Mailbox interface is for, how to write a condition, and how rule statuses and actions work.

⚠️

Beta feature: the AI rules module is currently in beta. Its behavior and interface may change, and some rough edges are possible. Feel free to send us your feedback.

⚠️

An AI model can make mistakes. Always start with the Audit status and review the matches before activating a rule. The content of analyzed emails is sent to our AI provider (see Privacy and limits).

What it is for

With Yara rules, you describe precise patterns to look for in an email. AI rules meet a different need: handling situations that are easy to describe in words but hard to express as patterns, such as an executive being impersonated, a sender who is supposed to belong to a specific domain, or a suspicious type of request.

You write a condition in plain language ("the sender's name is Jane Smith but the domain is not @example.com"), choose the action (tag or block), and an AI model reads every incoming email to say whether it matches your condition.

Where to find the module

In the Clean Mailbox interface, open your domain, then the AI rules menu. The module is reserved to domain administrators and must be enabled on the domain: if the menu entry isn't visible, contact us to have it enabled.

From this page you can create, edit, reorder and delete rules. Each rule holds:

Write the condition

The condition describes when the rule applies, not what to do: the action is chosen in a separate field. It fits in one sentence of 300 characters at most.

AvoidPrefer
"Block fraudulent emails"
(too vague, and says what to do)
"The email asks to change a bank account or payment details"
"Jane Smith"
(doesn't say what to check)
"The sender's name is Jane Smith but their address is not @example.com"
"Suspicious, urgent, odd email with an attachment…"
(several fuzzy criteria)
"The email claims to come from the IT department and asks to enter a password through a link"

Rule statuses

StatusIs the rule evaluated?Impact on email
Inactive No None. The rule is kept but ignored; it doesn't count toward your active rule limit.
Audit (log only) Yes None on the email, which is delivered normally. Every match is recorded with what the rule would have done.
Active Yes The action is applied: tag added to the subject, or email blocked.
💡

Recommended approach: always create the rule in audit, let it run for a few days, check that the matches are the ones you're aiming at (and that no legitimate email appears), then switch it to active. Reword the condition if needed.

Actions: tag or block

The action only applies if the rule is active (in audit, it is only logged).

Tag

The email is delivered, with the tag you defined added at the beginning of the subject, for example [IMPERSONATION?] Urgent transfer. The recipient is alerted but keeps the final say. The tag is required for this action (100 characters at most, no line break). If several tag rules match, all tags are added, on top of those from anti-spam, the Customer API and Yara rules.

Block

The email is not delivered: it is removed before reaching the recipient's mailbox, with no notification to the sender. A copy is kept in your quarantine. If a block and tags match on the same email, the block takes precedence.

Status"Tag" action"Block" action
Inactive Nothing (rule ignored) Nothing (rule ignored)
Audit Email delivered as is; "would have tagged" in the follow-up Email delivered as is; "would have blocked" in the follow-up
Active Email delivered, tag added to the subject Email removed, copy kept in quarantine
⚠️

The model works on probabilities: a false positive is always possible. Keep blocking for rules you have observed at length in audit, and prefer tagging for ambiguous cases.

Example rule

Goal: spot emails impersonating an executive, and alert the recipient without blocking at first.

FieldValue
TitleCEO impersonation
ConditionThe sender's name is "Jane Smith" but their email address is not from the @example.com domain
StatusAudit to begin with
ActionTag
Tag[IMPERSONATION?]
  1. Save the rule in audit and let it run for a week or two.
  2. Review the matches (see below): do the listed messages really impersonate the executive? Are there legitimate emails, for example a message sent from their personal address with your approval?
  3. If needed, reword the condition (add the legitimate addresses to exclude, clarify the context).
  4. Switch the rule to active: suspicious emails now arrive with the [IMPERSONATION?] tag in their subject.

Follow the matches

The AI rules page shows, for each rule, the number of matches over the last 30 days (audit included, with how many times the action was really applied) and the 20 latest matches.

In the realtime view, the emails concerned are shown as "AI" (not "Rules"), and an AI filter lets you see only those. Blocked emails are kept in your quarantine.

Privacy and limits

Frequently asked questions

How is it different from Yara rules?

Yara rules look for exact patterns: they are deterministic, fast and don't send data to a third party. AI rules understand the meaning of a message, but can be wrong and require sending the content to an AI provider. The two can be combined.

Can the model be fooled by an email's content?

An email may try to influence the model, but it cannot choose the action or the tag: they come from your rule. The worst effect is that its own message gets misclassified.

What happens if the AI service is down?

Emails are delivered normally, unmodified. No email is held back or lost.

Is a blocked email lost?

No. It is kept in your quarantine, where you can review it and restore it in case of a false positive.

Need help enabling the module?

Our support team can help you enable AI rules on your domain and validate its configuration. Writing and maintaining the rules themselves remains your responsibility.

Contact Clean Mailbox →

Let's protect your mailbox.

Questions about the trial, setup, pricing, or a partnership? We're here — and we answer fast.

✓ 30-day free trial, no card required
✓ Works with any mail server
✓ Setup in under 5 minutess
✓ Infrastructure based in France 🇫🇷